Computer-based activities are now subject to electronic vandalism. A vandal, who is sometimes called a hacker in this context, may attempt to intrude upon a network-connected computer system in order to steal information in an act of industrial espionage, or to alter records to the detriment or the benefit of another party's interests or reputation, or to impede the operation of the computer by implanting a virus or by flooding the computer with bogus information, or to implant a done or zombie that causes a host computer to launch an attack against a target computer.
More specifically, a vandal or hacker may attack a target such as an Internet web server by flooding the target with a torrential flow of disruptive messages that overload the target to the point of functional failure, where these messages bear a spoofed source address (source ID) so that the vandal cannot be easily identified. Attacks of this kind are called “denial of service” (DoS) attacks.
In one kind of denial-of-service attack, a vandal may send the target a large number of Internet Control Message Protocol (ICMP) messages called Packet INternet Gropers (PINGS), which are normally used to query whether a particular Internet address is accessible to the sender. Upon receiving a PING, the target responds to the spoofed device rather than the vandal, as the PING bears the fraudulently used identity of the spoofed device. By flooding the target with PINGS, the vandal may divert the target's resources to generating responses and consequently away from its legitimate tasks, and may also cause unproductive network congestion by triggering a flood of response messages.
In another kind of denial-of-service attack, the vandal may send the target a large number of TCP SYN messages. A TCP SYN message is normally used to initiate a TCP connection. Upon receiving a SYN message, the target sends a SYN/ACK message to the spoofed device rather than the vandal, as the SYN message bears the fraudulently used source ID of the spoofed device. Further, the target reserves an internal data structure presumably to be used in supporting a connection with the spoofed device. So, by flooding the target with a large number of SYN messages, the vandal causes not only the problems mentioned above—resource diversion and network congestion—but also exhausts the target's capacity to support the data structures needed to establish other connections. Thus, the target is left unable to establish connections with any device except the spoofed device.
Computers are often guarded against vandals' intrusions by intrusion detection systems. An intrusion detection system monitors the activities of users and would-be users for particular events or patterns of events generally known as signatures. A signature is a set of events and transition functions that define a sequence of actions that constitute misuse or unauthorized use of the computer. More specifically, a signature may include a signature event such as a particular pattern of bits. For example, the pattern may identify an incoming message that is designed to induce a deliberate violation of a communication protocol, where the kind of violation may be indicative of a malicious attack. An alert is generated when the intrusion detection system observer activity that is suggestive to an intrusion. The purpose of the alert is to inform a network administrator of the suspected attack, so that the administrator may take action to minimize the damage inflicted by the vandal.
To minimize the damage inflicted by a vandal, a network administrator may rely upon protective equipment that filters (i.e., blocks) incoming messages attributed to the actions of the vandal. For example, the administrator may configure a firewall or a network router to block incoming messages that seem to have a malicious purpose.
A particularly insidious kind of denial-of-service attack is a distributed-denial-of-service attack (DDoS). A vandal may prepare a DDoS attack well in advance by stealthily implanting so-called zombies or drones in a number of network-connected devices, for example into personal computers connected to the Internet by high-speed DSL or cable modems. Upon command by the hacker, each drone launches its own denial of service attack against the vandal's target. The target may be specified by information internal to the drones, or the target may be specified by a control message sent by the vandal to the drones to trigger the attack. The vandal may implant drones in a large number of unaware hosts, sometimes in hundreds of unaware hosts; consequently, the target may be subjected to a high volume of DDoS traffic, and the DDoS traffic may bear a wide range of source IDs.
Because the messages that constitutes a DDoS attack may bear a wide range of source IDs, the transitional methods described above for combating DoS attacks are at a severe disadvantage when confronted by a DDos attack—the target's intrusion detection system must determine a large number of source IDs, and the filter must be configured to block incoming messages from each.
In view of the difficulty of defending against a DDos attack, it is helpful to look at the problem in another way: network administrators may use health-checking equipment proactively to test a network connected device for the presence of a drone. Appropriate tools identify drones by searching for known signatures, and inform the network administrators when any are found. Thus a network administrator may identify and purge a drone, ideally before the vandal triggers the drone to attack. If the vandal triggers the drone before it is found by the health checking tool and purged by the administrator, however, the output of the drone may consume the capacity of its host, for example the capacity of the host's communication adapters, and may vest the party responsible for the host with moral fault for damage done to the target.
Unfortunately, the proactive use of health checking tools is not an entirely satisfactory solution to the problems caused by hosts that are compromised by imbedded drones. Such tools do not operate in real time; consequently, a vandal may well be able to implant a drone and trigger an attack before the network administrator can detect and purge the drone. Further, health checking tools check only for those signatures they know at the time of the health check, and may therefore be unable to detect a vandal's newest drone. Thus there is a need for an improved way of detecting the presence of a drone that compromises a network connected device, and thwarting the drone before it can damage either its host or the vandal's target.